Loggers
Loggers handle the output, storage, and processing of collected DNS data. They provide various formats and destinations for your DNS logs and act as the output layer of your DNS-collector pipeline.
For a detailed explanation of how these components are configured and chained together, see Pipeline Routing.
Logger Categories
Console & Local Files
Simple and direct local output destinations for debugging or local archiving.
| Logger | Status | Capabilities |
|---|---|---|
| Console | Production ready | • Outputs logs to standard output (stdout) • Supports Text, JSON, and raw binary formats |
| File | Production ready | • Saves logs to local files • Supports Plain text, JSON, and binary formats • Rotates log files dynamically |
Network Streaming & Forwarding
Forwarding raw or processed DNStap streams over standard network protocols.
| Logger | Status | Capabilities |
|---|---|---|
| DNStap Client | Production ready | • Forwards logs in DNStap format over TCP/Unix sockets • Frame stream (fstrm) protocol support |
| TCP | Production ready | • Streams logs over custom TCP connections |
| Syslog | Production ready | • Sends logs via standard syslog protocol (RFC3164/RFC5424) • Supports TLS encryption |
Metrics & Monitoring
Exposing and pushing real-time DNS metrics for monitoring dashboards.
| Logger | Status | Capabilities |
|---|---|---|
| Prometheus | Production ready | • Exposes Prometheus metric endpoints for scraping • Real-time query, response, and performance counters |
| StatsD | Beta support | • Sends performance metrics in StatsD format to remote daemons |
| REST API | Beta support | • Provides built-in webserver with REST API endpoints for real-time log searching |
Time-Series & Analytic Databases
Ingesting DNS records into high-performance analytical databases.
| Logger | Status | Capabilities |
|---|---|---|
| ClickHouse | Beta support | • High-performance columnar database ingestion for large-scale analytics |
| InfluxDB | Beta support | • Ingests DNS metrics and logs into InfluxDB v1.x/v2.x databases |
Log Aggregation Platforms
Sending logs to centralized log management and aggregation ecosystems.
| Logger | Status | Capabilities |
|---|---|---|
| Loki Client | Production ready | • Streams logs directly to Grafana Loki using the HTTP API |
| ElasticSearch | Production ready | • Indexes logs directly into Elasticsearch cluster |
| Fluentd | Beta support | • Forwards logs to Fluentd collectors |
| Scalyr | Beta support | • Sends logs to DataSet/Scalyr log analysis platform |
Message Queues & Streaming Brokers
Publishing DNS data to streaming platforms and message queues for downstream processing.
| Logger | Status | Capabilities |
|---|---|---|
| Redis Publisher | Production ready | • Publishes logs to Redis pub/sub channels |
| Kafka Producer | Production ready | • Sends logs to Apache Kafka topics with partition key options |
| NSQ | Beta support | • Publishes logs to NSQ topics |
| MQTT Publisher | Beta support | • Publishes DNS logs to MQTT brokers for IoT/messaging use cases |
Specialized Loggers
Advanced outputs for security, tracing, or performance benchmarking.
| Logger | Status | Capabilities |
|---|---|---|
| Falco | Beta support | • Integrates with Falco security monitoring to flag anomalies |
| OpenTelemetry | Experimental | • Distributed tracing and metrics support using OpenTelemetry protocols |
| DevNull | Production ready | • Discards all logs (useful for performance testing and benchmarking) |